cycbot | 25d0017301cd8252f6e6e499c0df1f9790df64fea1c64c8a2ce4ee652b093493

General

Target

JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe
Size

163KB
MD5

76cf655b9fc28c1fead90e6b2c8b3dbe
SHA1

364216d15a6f324fc13492f42522ed0ccc82cc75
SHA256

25d0017301cd8252f6e6e499c0df1f9790df64fea1c64c8a2ce4ee652b093493
SHA512

2454babc1ce757c655347a851210f38332c9d99efe947795ca045c6bda8c740e2e4cce23ff7813488aa8e862ad09f018fed6e23744b8a6eae22f76033d1f6be4
SSDEEP

3072:qIPkh4BR3Bw560TgT4reY/gjCYCiwVPiR40IXjLP7Yp6j3nKAxfTATuc832i15LN:qth4H3BwA0G4rP4tCiwcTIXLXbiE3VLW

Score

10^/10

cycbot backdoor discovery persistence rat spyware stealer upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/2024-13-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2300-14-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2300-83-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2836-87-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot
behavioral1/memory/2300-151-0x0000000000400000-0x0000000000443000-memory.dmp	family_cycbot

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\conhost.exe"	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2300-2-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2024-12-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2024-13-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2300-14-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2300-83-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2836-87-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2836-85-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/2300-151-0x0000000000400000-0x0000000000443000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2024	2300	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe	31
PID 2300 wrote to memory of 2024	2300	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe	31
PID 2300 wrote to memory of 2024	2300	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe	31
PID 2300 wrote to memory of 2024	2300	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe	31
PID 2300 wrote to memory of 2836	2300	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe	33
PID 2300 wrote to memory of 2836	2300	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe	33
PID 2300 wrote to memory of 2836	2300	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe	33
PID 2300 wrote to memory of 2836	2300	JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe	33

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe
  C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_76cf655b9fc28c1fead90e6b2c8b3dbe.exe startC:\Users\Admin\AppData\Local\Temp\csrss.exe%C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\CCC8.968

Filesize
1KB

MD5
0bccf385afb90fc959b16a0881d4fc1b

SHA1
7f24c6d852583064217b57d73b3d6afb132b4bfb

SHA256
095e848082d42f39ae27831157f326cdf3f85390c7aa646ac5a98cb19a6c8084

SHA512
9476ecc5087adaa37ce3a03f7efa98ecedac9f89a2cf89ac9c76b864d061e170e21a0ddbf513e2098780cc2cf4c7b7dd538726c07e42ad1e647d101a7d29e154

Download Submit
C:\Users\Admin\AppData\Roaming\CCC8.968

Filesize
600B

MD5
eae0e3e60263ddb418316e2c9a6a4165

SHA1
08a1a66579ef9aae87b180e44ecd5ec99e4151b1

SHA256
7858ae3d404a4034f1656476274add00ee5f49411fb919d7449de4dd49175e7f

SHA512
5bd2c22b11a39c3593d9fa526465b0388a91983e319ee0ebfc796967b5ba94bdf5cdda41c0348cecbe8ff30c95ae04ad7a97558c34b396d5f6e93f830b4d7bcd

Download Submit
C:\Users\Admin\AppData\Roaming\CCC8.968

Filesize
996B

MD5
4663f401805d14f414fe4a11cdacfcf1

SHA1
a1d090b53c88f58727e8e7b92889f87972ac9c6b

SHA256
650627a2b033a3372fa90eeb343ecf3d216b315d0267fb4366aa1e04fd9f91ef

SHA512
a7e27014d69b4486033641890e4da55585d3cd6548764531a0231e70fdea55458665cf25cdd83447dd03e200e6287e3b37521b5f00501f330211795d7df57033

Download Submit
memory/2024-12-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2024-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2300-1-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2300-2-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2300-14-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2300-83-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2300-151-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2836-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2836-85-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads